diff --git a/buildah.spec b/buildah.spec
index b229911..9ca051f 100644
--- a/buildah.spec
+++ b/buildah.spec
@@ -8,6 +8,10 @@
 %endif
 
 %global gomodulesmode GO111MODULE=on
+%global import_path github.com/containers/buildah
+%global branch release-1.43
+%global commit0 609eb9466b52e047421b7503323065c3b722497c
+%global shortcommit0 %(c=%{commit0}; echo ${c:0:7})
 
 %if %{defined fedora}
 %define build_with_btrfs 1
@@ -35,7 +39,7 @@ Epoch: 2
 Version: 1.43.2
 # The `AND` needs to be uppercase in the License for SPDX compatibility
 License: Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND MIT AND MPL-2.0
-Release: 1%{?dist}
+Release: 2%{?dist}
 %if %{defined golang_arches_future}
 ExclusiveArch: %{golang_arches_future}
 %else
@@ -43,8 +47,11 @@ ExclusiveArch: aarch64 ppc64le s390x x86_64
 %endif
 Summary: A command line tool used for creating OCI Images
 URL: https://%{name}.io
-# Tarball fetched from upstream
-Source: %{git0}/archive/v%{version}.tar.gz
+%if 0%{?branch:1}
+Source0: https://gitlab.cee.redhat.com/sustaining-engineering/container-tools/src-git/%{name}/-/archive/%{commit0}/%{branch}-%{shortcommit0}.tar.gz
+%else
+Source0: https://%{import_path}/archive/%{commit0}/%{name}-%{version}-%{shortcommit0}.tar.gz
+%endif
 BuildRequires: device-mapper-devel
 BuildRequires: git-core
 BuildRequires: golang >= 1.16.6
@@ -108,7 +115,11 @@ Requires: git-daemon
 This package contains system tests for %{name}
 
 %prep
-%autosetup -Sgit -n %{name}-%{version}
+%if 0%{?branch:1}
+%autosetup -Sgit -n %{name}-%{commit0}
+%else
+%autosetup -Sgit -n %{name}-%{commit0}
+%endif
 
 %build
 %set_build_flags
@@ -194,6 +205,11 @@ rm %{buildroot}%{_datadir}/%{name}/test/system/tools/build/*
 %{_datadir}/%{name}/test
 
 %changelog
+* Wed Aug 05 2026 Jindrich Novy <jnovy@redhat.com> - 2:1.43.2-2
+- bump golang.org/x/crypto to v0.53.0 to fix CVE-2026-46597
+- Switch Source0 to consume tarball from the internal GitLab sustaining-engineering repo instead of GitHub.
+- Resolves: RHEL-219427
+
 * Wed Jun 17 2026 Jindrich Novy <jnovy@redhat.com> - 2:1.43.2-1
 - update to https://github.com/containers/buildah/releases/tag/v1.43.2
 - Resolves: RHEL-185739
diff --git a/sources b/sources
index f52d86a..fc6e9db 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (v1.43.2.tar.gz) = 17009c78c713eb397cc7d791edb7e0470a3c2d6032fc0706af8aabf81a7849ed4abd420b3afbc67ce2c9464ae5ddccccd7a52bc9426a73e1d72884403d4a14d4
+SHA512 (release-1.43-609eb94.tar.gz) = 61445e77cc45b383677fb3351cf8b2232ccfa97d9b876d5bcce8525639c86d051b66467cdc4b7730cba103e933b83892d2ec41b1ac3f80015a7b35c8450aa19d